Hi Harry,
As an interim option you can transmit the key as a query parameter instead of a header (e.g. /a/b/c/?apiKey=FOO).
But, I think you're right. As I understand the CORS spec, we should always allow an OPTIONS requests to (minimally) enter the policy chain, because browsers don't make a CORS preflight request with any custom headers (they simply don't transmit them).
Under certain circumstances it might allow a client to hit a backend without a key when we don't want it to. Although I imagine the impact of this should generally be quite minimal.
Others: Any thoughts?